Turborepo

<!-- Release notes generated using configuration in .github/release.yml at v2.9.16 -->

What's Changed

Changelog

• release(turborepo): 2.9.15 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12955
• fix: Avoid hanging PTY shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/12958
• fix: Retry npm tlog publish failures by @anthonyshew in https://github.com/vercel/turborepo/pull/12959
• release(turborepo): 2.9.16-canary.1 by @anthonyshew in https://github.com/vercel/turborepo/pull/12960
• fix: Preserve nested Bun dependency versions by @anthonyshew in https://github.com/vercel/turborepo/pull/12963
• Revert "fix: Preserve nested Bun dependency versions" by @anthonyshew in https://github.com/vercel/turborepo/pull/12964
• release(turborepo): 2.9.16-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12961
• fix: Preserve nested Bun dependency versions by @anthonyshew in https://github.com/vercel/turborepo/pull/12965
• fix: Don't delete existing .git when using --no-git flag by @anthonyshew in https://github.com/vercel/turborepo/pull/12968

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.15...v2.9.16

<!-- Release notes generated using configuration in .github/release.yml at v2.9.15 -->

What's Changed

Changelog

• release(turborepo): 2.9.14 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12805
• fix: Prune package.json workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/12808
• fix: Wait for process trees before task completion by @anthonyshew in https://github.com/vercel/turborepo/pull/12809
• release(turborepo): 2.9.15-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12810
• ci: Sign macOS release binaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12811
• release(turborepo): 2.9.15-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12812
• fix: Prevent cache archive symlink reads by @anthonyshew in https://github.com/vercel/turborepo/pull/12813
• release(turborepo): 2.9.15-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12814
• fix: Avoid path-racy chmod during directory restore by @anthonyshew in https://github.com/vercel/turborepo/pull/12815
• fix: Prevent cache restore symlink race writes by @anthonyshew in https://github.com/vercel/turborepo/pull/12817
• chore: Deny Rust panic extraction by default by @anthonyshew in https://github.com/vercel/turborepo/pull/12818
• fix: Make structured log symlink defense race-safe by @anthonyshew in https://github.com/vercel/turborepo/pull/12821
• fix: Preserve Bun alias child packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12822
• fix: Avoid UTF-8 panics at boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12823
• fix: Preserve non-UTF-8 Git path boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12826
• fix: Create daemon dirs with private permissions by @anthonyshew in https://github.com/vercel/turborepo/pull/12827
• fix: Return Berry lockfile errors instead of panicking by @anthonyshew in https://github.com/vercel/turborepo/pull/12828
• fix: Isolate Corepack state in integration tests by @anthonyshew in https://github.com/vercel/turborepo/pull/12831
• ci: Use larger Windows runners for Rust tests by @anthonyshew in https://github.com/vercel/turborepo/pull/12832
• docs: Add with-vite-module-federation example by @gioboa in https://github.com/vercel/turborepo/pull/12794
• test: Run Rust tests without partitioning by @anthonyshew in https://github.com/vercel/turborepo/pull/12833
• chore: Remove TaskHashTracker-based expect() calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12836
• chore: Deduplicate hash canonicalization by @anthonyshew in https://github.com/vercel/turborepo/pull/12837
• fix: Prevent Windows process drain hangs by @anthonyshew in https://github.com/vercel/turborepo/pull/12838
• fix: Refactor execsync to execfilesync for Shell command built from environment values by @bjormgyg in https://github.com/vercel/turborepo/pull/12829
• test: Bound vt100 random quickcheck by @anthonyshew in https://github.com/vercel/turborepo/pull/12839
• fix: Validate daemon discovery responses by @anthonyshew in https://github.com/vercel/turborepo/pull/12840
• fix: Store PackageGraph root invariants by @anthonyshew in https://github.com/vercel/turborepo/pull/12841
• chore: Avoid engine graph node expects by @anthonyshew in https://github.com/vercel/turborepo/pull/12842
• test: Make Rust tests parallel-safe by @anthonyshew in https://github.com/vercel/turborepo/pull/12843
• fix: Avoid graph utility node lookup panics by @anthonyshew in https://github.com/vercel/turborepo/pull/12844
• fix: Avoid graph walker expect() calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12845
• fix: Remove fs panic extraction lints by @anthonyshew in https://github.com/vercel/turborepo/pull/12846
• fix: Remove fixed map panic extraction calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12847
• fix: Remove devtools WebSocket panics by @anthonyshew in https://github.com/vercel/turborepo/pull/12850
• fix: Remove json rewrite panic lint allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12848
• fix: Remove turborepo-types panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12849
• chore: Remove turborepo-hash build expect by @anthonyshew in https://github.com/vercel/turborepo/pull/12851
• fix: Remove napi panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12852
• fix: Avoid globwatch expect calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12853
• fix: Remove LSP expect callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12854
• fix: Remove scope panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12855
• fix: Remove task hash panic lints by @anthonyshew in https://github.com/vercel/turborepo/pull/12856
• fix: Remove frameworks panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12857
• fix: Remove microfrontends proxy expect lint allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12859
• fix: Avoid API client expect calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12858
• fix: Avoid task executor expect calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12860
• fix: Remove turbo-trace unwrap callsite by @anthonyshew in https://github.com/vercel/turborepo/pull/12863
• fix: Remove Vercel API mock expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12862
• fix: Remove vt100 expect lint allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12861
• fix: Remove turborepo-shim expect callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12864
• test: Deflake daemon existing process test by @anthonyshew in https://github.com/vercel/turborepo/pull/12865
• fix: Avoid repository NAPI unwrap calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12866
• fix: Remove pidlock panic callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12867
• fix: Remove telemetry panic callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12868
• chore: Remove Rust re-export shims by @anthonyshew in https://github.com/vercel/turborepo/pull/12870
• fix: Remove turbo-json panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12869
• fix: Remove globwalk's expect() callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12871
• fix: Remove turbopath's expect() callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12872
• test: Deflake Corepack prepare lock on Windows by @anthonyshew in https://github.com/vercel/turborepo/pull/12873
• fix: Remove signals panic callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12874
• fix: Remove turbo-trace's expect() allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12876
• fix: Remove Vercel API mock unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12877
• fix: Remove task executor unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12878
• fix: Remove run summary expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12879
• fix: Remove microfrontends proxy unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12880
• fix: Remove api client unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12881
• fix: Remove globwalk unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12883
• fix: Remove UI expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12882
• fix: Remove microfrontends expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12885
• fix: Remove boundaries's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12887
• fix: Remove turborepo-process's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12888
• fix: Remove UI unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12889
• fix: Remove microfrontends unwrap allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12890
• fix: Remove turborepo-process's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12891
• fix: Remove scm expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12893
• fix: Remove auth unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12886
• fix: Remove turbopath's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12884
• fix: Remove auth's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12895
• fix: Remove wax unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12899
• fix: Remove scm unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12897
• fix: Remove turborepo-boundaries's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12896
• fix: Remove daemon unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12898
• fix: Include lockfile-changed packages in affected tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12900
• fix: Remove turborepo-wax's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12901
• fix: Remove turborepo-filewatch's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12903
• fix: Remove turborepo-cache's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12902
• fix: Remove turborepo-daemon's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12904
• fix: Remove turborepo-engine's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12906
• fix: Remove filewatch unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12907
• fix: Remove engine expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12908
• fix: Remove cache unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12909
• fix: Remove turborepo-lockfiles expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12910
• chore: Set pnpm minimum release age by @anthonyshew in https://github.com/vercel/turborepo/pull/12912
• fix: Remove turborepo-lockfiles's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12911
• fix: Remove turborepo-vt100's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12913
• release(turborepo): 2.9.15-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12905
• fix: Remove turborepo-lib's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12915
• fix: Remove turborepo-lib's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12914
• fix: Remove shim test unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12917
• fix: Remove turbo json test unwrap allowance by @anthonyshew in https://github.com/vercel/turborepo/pull/12918
• fix: Remove run summary test unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12916
• release(turborepo): 2.9.15-canary.5 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12919
• fix: Restore task completion semantics by @anthonyshew in https://github.com/vercel/turborepo/pull/12923
• fix: Preserve nested Bun workspace dependency versions by @anthonyshew in https://github.com/vercel/turborepo/pull/12924
• release(turborepo): 2.9.15-canary.6 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12925
• fix: Restore release PR auto-merge by @anthonyshew in https://github.com/vercel/turborepo/pull/12927
• perf: Index repo gitignore matchers by @anthonyshew in https://github.com/vercel/turborepo/pull/12928
• ci: Disable incremental Rust test builds by @anthonyshew in https://github.com/vercel/turborepo/pull/12929
• perf: Trim OpenTelemetry crate features by @anthonyshew in https://github.com/vercel/turborepo/pull/12930
• perf: Trim microfrontends proxy HTTP features by @anthonyshew in https://github.com/vercel/turborepo/pull/12931
• fix: Accept experimentalCI object config by @anthonyshew in https://github.com/vercel/turborepo/pull/12934
• release(turborepo): 2.9.15-canary.7 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12935
• fix: Restore a few internal invariant checks by @anthonyshew in https://github.com/vercel/turborepo/pull/12933
• fix: Improve profile tracing coverage by @anthonyshew in https://github.com/vercel/turborepo/pull/12936
• fix: Use build-scale OTel duration buckets by @anthonyshew in https://github.com/vercel/turborepo/pull/12939
• fix: Preserve pnpm injected peer package entries by @anthonyshew in https://github.com/vercel/turborepo/pull/12940
• feat: Add heap allocation profiling by @anthonyshew in https://github.com/vercel/turborepo/pull/12943
• release(turborepo): 2.9.15-canary.8 by @anthonyshew in https://github.com/vercel/turborepo/pull/12945
• docs: Correct attribute presence claims in turborepo-otel by @adityasingh2400 in https://github.com/vercel/turborepo/pull/12932
• chore(turbo-codemod): Remove duplicate "in" in transforms path comment by @mvanhorn in https://github.com/vercel/turborepo/pull/12948
• chore: Switch Geist font imports to npm geist package by @christopherkindl in https://github.com/vercel/turborepo/pull/12952
• fix: Respect root gitignore during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12953
• fix: Harden OTEL endpoint validation by @anthonyshew in https://github.com/vercel/turborepo/pull/12954

New Contributors

• @gioboa made their first contribution in https://github.com/vercel/turborepo/pull/12794
• @bjormgyg made their first contribution in https://github.com/vercel/turborepo/pull/12829
• @adityasingh2400 made their first contribution in https://github.com/vercel/turborepo/pull/12932
• @mvanhorn made their first contribution in https://github.com/vercel/turborepo/pull/12948
• @christopherkindl made their first contribution in https://github.com/vercel/turborepo/pull/12952

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.14...v2.9.15

High:

• GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

• GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation
• GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

<!-- Release notes generated using configuration in .github/release.yml at v2.9.14 -->

What's Changed

Changelog

• release(turborepo): 2.9.12 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12774
• fix: Restore docs mobile menu by @anthonyshew in https://github.com/vercel/turborepo/pull/12782
• ci: Use pull_request for PR title linting by @anthonyshew in https://github.com/vercel/turborepo/pull/12787
• ci: Scope GitHub Actions caches by branch by @anthonyshew in https://github.com/vercel/turborepo/pull/12788
• test: Validate lockfiles without dependency downloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12789
• Removed unneeded import form hash creation script in docs by @dancrumb in https://github.com/vercel/turborepo/pull/12799
• fix: Validate auth callback state by @anthonyshew in https://github.com/vercel/turborepo/pull/12802
• fix: Harden VS Code extension command execution by @anthonyshew in https://github.com/vercel/turborepo/pull/12800
• fix: Avoid project-local Yarn during detection by @anthonyshew in https://github.com/vercel/turborepo/pull/12801
• chore: Release 2.9.13 by @anthonyshew in https://github.com/vercel/turborepo/pull/12803

New Contributors

• @dancrumb made their first contribution in https://github.com/vercel/turborepo/pull/12799

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.12...v2.9.14

<!-- Release notes generated using configuration in .github/release.yml at v2.9.12 -->

What's Changed

Changelog

• release(turborepo): 2.9.11 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12771
• fix: Allow transit nodes in LSP diagnostics by @anthonyshew in https://github.com/vercel/turborepo/pull/12773

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.11...v2.9.12

<!-- Release notes generated using configuration in .github/release.yml at v2.9.11 -->

What's Changed

Changelog

• release(turborepo): 2.9.10 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12745
• ci: Publish VS Code extension on release by @anthonyshew in https://github.com/vercel/turborepo/pull/12747
• fix: Start daemon for VSCode Extension from the extension itself by @anthonyshew in https://github.com/vercel/turborepo/pull/12749
• release(turborepo): 2.9.11-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12748
• fix: Include file URIs in LSP lifecycle logs by @anthonyshew in https://github.com/vercel/turborepo/pull/12751
• fix: Handle JSON decoration visitor depth by @anthonyshew in https://github.com/vercel/turborepo/pull/12752
• fix: Resolve relative turbo path in VS Code extension by @anthonyshew in https://github.com/vercel/turborepo/pull/12753
• fix: Preserve Bun nested dependencies during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12754
• fix: Prefer installed Turbo for LSP by @anthonyshew in https://github.com/vercel/turborepo/pull/12755
• release(turborepo): 2.9.11-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12750
• ci: Parallelize LSP release publishing by @anthonyshew in https://github.com/vercel/turborepo/pull/12758
• fix: Reduce VS Code extension startup popups by @anthonyshew in https://github.com/vercel/turborepo/pull/12759
• fix: Support turbo.jsonc in VS Code extension by @anthonyshew in https://github.com/vercel/turborepo/pull/12760
• fix: Remove VS Code task key gradient by @anthonyshew in https://github.com/vercel/turborepo/pull/12761
• release(turborepo): 2.9.11-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12756
• chore: Release v2.9.11-canary.4 by @anthonyshew in https://github.com/vercel/turborepo/pull/12762
• ci: Stop VS Code publish from blocking release PR by @anthonyshew in https://github.com/vercel/turborepo/pull/12763
• release(turborepo): 2.9.11-canary.5 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12764
• fix: Publish VS Code extension from release tag by @anthonyshew in https://github.com/vercel/turborepo/pull/12765
• fix: Support shimmed VS Code LSP probes by @anthonyshew in https://github.com/vercel/turborepo/pull/12767
• release(turborepo): 2.9.11-canary.6 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12766
• release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12768
• fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in https://github.com/vercel/turborepo/pull/12770

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.10...v2.9.11

<!-- Release notes generated using configuration in .github/release.yml at v2.9.10 -->

What's Changed

Changelog

• release(turborepo): 2.9.9-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12716
• release(turborepo): 2.9.9 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12719
• fix: Respect SCM env vars in turbo query affected by @anthonyshew in https://github.com/vercel/turborepo/pull/12722
• ci: Package VSCode extension in release workflow by @anthonyshew in https://github.com/vercel/turborepo/pull/12723
• fix: Avoid some raw create-turbo example telemetry by @anthonyshew in https://github.com/vercel/turborepo/pull/12725
• fix: Escape graph HTML payloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12726
• fix: Prevent OTEL token injection to spoofed origins by @anthonyshew in https://github.com/vercel/turborepo/pull/12727
• fix: Retry HTTP status failures by @anthonyshew in https://github.com/vercel/turborepo/pull/12728
• fix: Validate microfrontend proxy Host header by @anthonyshew in https://github.com/vercel/turborepo/pull/12730
• fix: Redact task hash env debug logs by @anthonyshew in https://github.com/vercel/turborepo/pull/12733
• fix: Filter microfrontend proxy environments by @anthonyshew in https://github.com/vercel/turborepo/pull/12732
• fix: Preserve FSEvents mount points for device-relative paths by @anthonyshew in https://github.com/vercel/turborepo/pull/12729
• fix: Validate proxy Host headers by @anthonyshew in https://github.com/vercel/turborepo/pull/12731
• fix: Resolve TypeScript .js extension imports to .ts files in boundaries by @maschwenk in https://github.com/vercel/turborepo/pull/12644
• fix: Use random temp path for repo downloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12736
• release(turborepo): 2.9.10-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12734
• fix: Reject OTel endpoints with userinfo by @anthonyshew in https://github.com/vercel/turborepo/pull/12737
• fix: Authenticate local devtools WebSocket by @anthonyshew in https://github.com/vercel/turborepo/pull/12738
• fix: Handle clipboard exec errors by @anthonyshew in https://github.com/vercel/turborepo/pull/12739
• fix: Restrict Vercel token reuse to trusted API origins by @anthonyshew in https://github.com/vercel/turborepo/pull/12740
• fix: Keep workspace config discovery inside root by @anthonyshew in https://github.com/vercel/turborepo/pull/12741
• fix: Hardening for daemon IPC endpoints by @anthonyshew in https://github.com/vercel/turborepo/pull/12742
• fix: Enforce cache filesystem boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12743

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.9...v2.9.10

<!-- Release notes generated using configuration in .github/release.yml at v2.9.9 -->

What's Changed

Changelog

• release(turborepo): 2.9.8 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12700
• fix: Remove Unix parent death watchdogs by @anthonyshew in https://github.com/vercel/turborepo/pull/12699
• release(turborepo): 2.9.9-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12705
• fix: Scope repo index prefixes to Git root by @anthonyshew in https://github.com/vercel/turborepo/pull/12706
• release(turborepo): 2.9.9-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12708
• ci: Harden non-release GitHub Actions by @anthonyshew in https://github.com/vercel/turborepo/pull/12707
• docs: Add pnpm workspace flag (-w) to Oxc setup docs by @mattjoll in https://github.com/vercel/turborepo/pull/12655
• fix: Harden OG image signatures by @anthonyshew in https://github.com/vercel/turborepo/pull/12709
• fix: Scope release npm publishing credentials by @anthonyshew in https://github.com/vercel/turborepo/pull/12710
• ci: Harden release workflows by @anthonyshew in https://github.com/vercel/turborepo/pull/12711
• release(turborepo): 2.9.9-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12712
• fix: Harden docs security endpoints by @anthonyshew in https://github.com/vercel/turborepo/pull/12713
• ci: Harden internal GitHub Actions by @anthonyshew in https://github.com/vercel/turborepo/pull/12714
• ci: Harden release workflow handling by @anthonyshew in https://github.com/vercel/turborepo/pull/12715
• fix: Preserve lockfiles during dry-run conversion by @anthonyshew in https://github.com/vercel/turborepo/pull/12717
• ci: Fix LSP workflow container matrix by @anthonyshew in https://github.com/vercel/turborepo/pull/12718

New Contributors

• @mattjoll made their first contribution in https://github.com/vercel/turborepo/pull/12655

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.8...v2.9.9

<!-- Release notes generated using configuration in .github/release.yml at v2.9.8 -->

What's Changed

@turbo/repository

• chore: Update to Rust 1.95.0 by @ognevny in https://github.com/vercel/turborepo/pull/12636

Changelog

• release(turborepo): 2.9.7 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12679
• test: Add regression for gitignored output restore by @anthonyshew in https://github.com/vercel/turborepo/pull/12681
• docs: Clarify root task guidance by @anthonyshew in https://github.com/vercel/turborepo/pull/12683
• fix: Preserve concrete dependency precedence by @anthonyshew in https://github.com/vercel/turborepo/pull/12682
• release(turborepo): 2.9.8-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12685
• fix: Resolve Yarn catalog affected packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12684
• release(turborepo): 2.9.8-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12687
• fix: Preserve Bun prune lockfile validity by @anthonyshew in https://github.com/vercel/turborepo/pull/12686
• release(turborepo): 2.9.8-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12689
• fix: Create prune docker bin stubs by @anthonyshew in https://github.com/vercel/turborepo/pull/12688
• release(turborepo): 2.9.8-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12690
• fix: Keep tbx shell connections stable by @anthonyshew in https://github.com/vercel/turborepo/pull/12692
• perf: Reduce turbo watch hash memory spikes by @anthonyshew in https://github.com/vercel/turborepo/pull/12695
• release(turborepo): 2.9.8-canary.5 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12696
• fix: Reduce parent-death watchdog CPU usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12697
• release(turborepo): 2.9.8-canary.6 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12698

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.7...v2.9.8

<!-- Release notes generated using configuration in .github/release.yml at v2.9.7 -->

What's Changed

eslint

• chore: Upgrade dependencies to resolve their known vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/12604

Examples

• feat(sandbox): Bump @vercel/sandbox from v1 to beta by @marc-vercel in https://github.com/vercel/turborepo/pull/12595
• chore: Update examples to Turbo 2.9.6 by @cursor[bot] in https://github.com/vercel/turborepo/pull/12600
• examples: Add Ultracite example by @haydenbleasel in https://github.com/vercel/turborepo/pull/12615

Changelog

• fix: Align Markdown docs routing with docs/md endpoints by @molebox in https://github.com/vercel/turborepo/pull/12596
• fix: Support two-dot git ranges in filter selectors by @anthonyshew in https://github.com/vercel/turborepo/pull/12599
• feat: Graceful shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/12607
• test: Add stdin EOF startup regression coverage by @anthonyshew in https://github.com/vercel/turborepo/pull/12609
• fix: Ignore SIGINT in shim after spawning local turbo by @anthonyshew in https://github.com/vercel/turborepo/pull/12612
• fix: Support pnpm v11 multi-document lockfiles by @anthonyshew in https://github.com/vercel/turborepo/pull/12616
• fix: Preserve graceful shutdown exit code by @anthonyshew in https://github.com/vercel/turborepo/pull/12620
• fix: Keep Node wrapper alive during graceful shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/12622
• fix: Preserve PTY graceful shutdown semantics by @anthonyshew in https://github.com/vercel/turborepo/pull/12624
• feat: Move Vercel auth to standard OAuth/device flows by @markandrus in https://github.com/vercel/turborepo/pull/12526
• fix: Preserve legacy Vercel auth compatibility by @anthonyshew in https://github.com/vercel/turborepo/pull/12629
• fix: Recover Vercel auth tokens across login flows by @anthonyshew in https://github.com/vercel/turborepo/pull/12631
• docs: Fix TURBO_PLATFORM_ENV_DISABLED value in docs (true, not false) by @sleitor in https://github.com/vercel/turborepo/pull/12633
• chore: Update flags SDK by @AndyBitz in https://github.com/vercel/turborepo/pull/12646
• ci: Disable AWS-backed sccache by @anthonyshew in https://github.com/vercel/turborepo/pull/12663
• fix: Prevent prune from overmatching gitignore entries by @anthonyshew in https://github.com/vercel/turborepo/pull/12662
• ci: Harden release API commits by @anthonyshew in https://github.com/vercel/turborepo/pull/12664
• ci: Fix release API commit paths by @anthonyshew in https://github.com/vercel/turborepo/pull/12665
• release(turborepo): 2.9.7-canary.14 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12666
• chore: Add tbx sandbox helper by @anthonyshew in https://github.com/vercel/turborepo/pull/12668
• fix: Allow npm registry in tbx sandboxes by @anthonyshew in https://github.com/vercel/turborepo/pull/12669
• fix: Install turbo globally in tbx base by @anthonyshew in https://github.com/vercel/turborepo/pull/12670
• docs: Clarify package hash file inputs by @anthonyshew in https://github.com/vercel/turborepo/pull/12671
• fix: Allow tbx sandboxes to use stale bases by @anthonyshew in https://github.com/vercel/turborepo/pull/12672
• fix: Install dotfiles during tbx base refresh by @anthonyshew in https://github.com/vercel/turborepo/pull/12673
• fix: Improve tbx sandbox startup by @anthonyshew in https://github.com/vercel/turborepo/pull/12674
• fix: Improve tbx sandbox startup defaults by @anthonyshew in https://github.com/vercel/turborepo/pull/12675
• fix: Support pnpm 11 flat patch lockfiles by @anthonyshew in https://github.com/vercel/turborepo/pull/12676
• docs: Fix link to passthrough variables source code by @Wartijn in https://github.com/vercel/turborepo/pull/12643
• release(turborepo): 2.9.7-canary.15 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12677
• fix: Avoid rerunning non-cacheable watch dependencies by @anthonyshew in https://github.com/vercel/turborepo/pull/12678

New Contributors

• @marc-vercel made their first contribution in https://github.com/vercel/turborepo/pull/12595
• @cursor[bot] made their first contribution in https://github.com/vercel/turborepo/pull/12600
• @markandrus made their first contribution in https://github.com/vercel/turborepo/pull/12526
• @AndyBitz made their first contribution in https://github.com/vercel/turborepo/pull/12646
• @Wartijn made their first contribution in https://github.com/vercel/turborepo/pull/12643

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.6...v2.9.7

<!-- Release notes generated using configuration in .github/release.yml at v2.9.6 -->

What's Changed

create-turbo

• chore: Update dependencies found in audits by @anthonyshew in https://github.com/vercel/turborepo/pull/12586

Examples

• fix: Add missing @types/node to with-svelte example apps by @anthonyshew in https://github.com/vercel/turborepo/pull/12585

Changelog

• docs: Add Bun equivalent for updating dependencies by @anthonyshew in https://github.com/vercel/turborepo/pull/12580
• fix: Mention turbo.json in concurrency error message by @anthonyshew in https://github.com/vercel/turborepo/pull/12582
• fix: Surface actionable message when remote cache is requested but not linked by @anthonyshew in https://github.com/vercel/turborepo/pull/12584
• chore: Delete agents app by @anthonyshew in https://github.com/vercel/turborepo/pull/12587
• fix: Load custom CA certificates in fast webpki-only HTTP client by @anthonyshew in https://github.com/vercel/turborepo/pull/12591
• docs: Remove pre-release badges by @anthonyshew in https://github.com/vercel/turborepo/pull/12592

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.5...v2.9.6

<!-- Release notes generated using configuration in .github/release.yml at v2.9.5 -->

What's Changed

create-turbo

• feat: Replace package manager commands in scaffolded README files by @DependerKumarSoni in https://github.com/vercel/turborepo/pull/6747

@turbo/telemetry

• fix: Suppress telemetry alert when running on Vercel by @anthonyshew in https://github.com/vercel/turborepo/pull/12576

Changelog

• feat: Add circular package dependency detection to boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12567
• perf: Increase remote cache upload chunk size from 8KB to 256KB by @anthonyshew in https://github.com/vercel/turborepo/pull/12568
• perf: Parallelize boundaries checking with Rayon and cache DFS traversals by @anthonyshew in https://github.com/vercel/turborepo/pull/12569

New Contributors

• @DependerKumarSoni made their first contribution in https://github.com/vercel/turborepo/pull/6747

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.4...v2.9.5

<!-- Release notes generated using configuration in .github/release.yml at v2.9.4 -->

What's Changed

@turbo/codemod

• fix: Always update $schema URL to versioned format during migration by @anthonyshew in https://github.com/vercel/turborepo/pull/12529
• fix: Support turbo.jsonc in codemod transforms by @anthonyshew in https://github.com/vercel/turborepo/pull/12532
• fix: Preserve prerelease info in schema URL during codemod migration by @anthonyshew in https://github.com/vercel/turborepo/pull/12542

Examples

• build(deps): Bump @xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @dependabot[bot] in https://github.com/vercel/turborepo/pull/12537

Changelog

• feat: Add incremental task caching by @anthonyshew in https://github.com/vercel/turborepo/pull/12531
• docs: Send siteId as label on feedback GitHub issues by @molebox in https://github.com/vercel/turborepo/pull/12527
• Replace local ai-agent-detection with @vercel/agent-readability by @molebox in https://github.com/vercel/turborepo/pull/12528
• fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @anthonyshew in https://github.com/vercel/turborepo/pull/12535
• fix: Only enforce signature key length for keys that exist by @anthonyshew in https://github.com/vercel/turborepo/pull/12538
• fix: Validate engine concurrency after task-level filtering by @anthonyshew in https://github.com/vercel/turborepo/pull/12540
• feat: Allow --affected and --filter to be combined by @anthonyshew in https://github.com/vercel/turborepo/pull/12543
• fix(config): Deep-merge nested OTEL config across priority sources by @bitttttten in https://github.com/vercel/turborepo/pull/12513
• fix: Retain microfrontend proxy tasks when using filterUsingTasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12545
• fix: Bun workspace lockfile pruning producing invalid output by @JRoy in https://github.com/vercel/turborepo/pull/12548
• fix: Respect dirty .gitignore patterns during task input hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/12557

New Contributors

• @JRoy made their first contribution in https://github.com/vercel/turborepo/pull/12548

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.3...v2.9.4

<!-- Release notes generated using configuration in .github/release.yml at v2.8.21 -->

What's Changed

Docs

• fix: Strip JSX components from heading anchors and TOC entries by @anthonyshew in https://github.com/vercel/turborepo/pull/12404

eslint

• fix(eslint-plugin-turbo): Guard against missing tasks/pipeline in forEachTaskDef by @sleitor in https://github.com/vercel/turborepo/pull/12411

@turbo/repository

• feat: Add packagesFromLockfile() NAPI binding to @turbo/repository by @anthonyshew in https://github.com/vercel/turborepo/pull/12454
• release(library): 0.0.1-canary.21 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12455

Examples

• fix(examples): Update of with-svelte example by @floriansalihovic in https://github.com/vercel/turborepo/pull/11952
• fix: Use script-shell=bash for cross-platform with-shell-commands example by @Goldyvaiiii in https://github.com/vercel/turborepo/pull/12436

Changelog

• docs: Add link to Docker guide in prune --docker flag section by @styfle in https://github.com/vercel/turborepo/pull/12401
• feat: Add global configuration key behind futureFlags.globalConfiguration by @anthonyshew in https://github.com/vercel/turborepo/pull/12399
• chore: Update CODEOWNERS to remove /docs owner by @anthonyshew in https://github.com/vercel/turborepo/pull/12402
• fix: Move docs app icons into app/ directory by @anthonyshew in https://github.com/vercel/turborepo/pull/12403
• feat: Add experimental structured logging with --json and --log-file flags by @anthonyshew in https://github.com/vercel/turborepo/pull/12405
• docs: Downgrade Next.js by @anthonyshew in https://github.com/vercel/turborepo/pull/12408
• chore: Deprecate the turbo scan command by @anthonyshew in https://github.com/vercel/turborepo/pull/12406
• chore: Upgrade Next.js by @anthonyshew in https://github.com/vercel/turborepo/pull/12415
• Revert "fix: Flush stale mouse tracking events from stdin during TUI cleanup" by @anthonyshew in https://github.com/vercel/turborepo/pull/12416
• fix: Add NixOS environment variables to default passthroughs by @anthonyshew in https://github.com/vercel/turborepo/pull/12417
• fix: Resolve security vulnerabilities in tar and rustls-webpki by @anthonyshew in https://github.com/vercel/turborepo/pull/12418
• docs: Promote turbo query from experimental to stable by @anthonyshew in https://github.com/vercel/turborepo/pull/12421
• docs: Clarify turbo-ignore's future by @anthonyshew in https://github.com/vercel/turborepo/pull/12422
• feat: Rework turbo ls to use query internals and add turbo query ls shorthand by @anthonyshew in https://github.com/vercel/turborepo/pull/12424
• docs: Clarify environment variables across packages dependency behavior by @ramanverse in https://github.com/vercel/turborepo/pull/12390
• docs: Expand subpath imports example by @lilianakatrina684-a11y in https://github.com/vercel/turborepo/pull/12412
• fix: Preserve source dependencies when adding workspace deps in turbo-gen by @sleitor in https://github.com/vercel/turborepo/pull/11935
• docs: Add Git history requirements to turbo query affected docs by @anthonyshew in https://github.com/vercel/turborepo/pull/12426
• fix: Prevent horizontal overflow from long inline code on narrow viewports by @anthonyshew in https://github.com/vercel/turborepo/pull/12428
• feat: Send git SHA and dirty hash to remote cache by @mehulkar in https://github.com/vercel/turborepo/pull/12427
• fix: Upgrade tokio to 1.47.1+ to fix pidfd_reaper panic by @anthonyshew in https://github.com/vercel/turborepo/pull/12431
• docs: Add AI guide to sidebar navigation by @anthonyshew in https://github.com/vercel/turborepo/pull/12438
• docs: Move experimentalObservability into futureFlags section by @anthonyshew in https://github.com/vercel/turborepo/pull/12439
• fix: Skip Unix domain sockets and other special files during file hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/12445
• fix: Preserve dedupePeers and unknown pnpm lockfile settings by @attehuhtakangas in https://github.com/vercel/turborepo/pull/12443
• fix: Align dry run cache status with normal run by checking caching guards by @anthonyshew in https://github.com/vercel/turborepo/pull/12448
• fix: Resolve turbo watch hang with mixed interruptible persistent tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12449
• fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes by @anthonyshew in https://github.com/vercel/turborepo/pull/12452
• refactor: Move cache hit SHA context to verbose logging by @mehulkar in https://github.com/vercel/turborepo/pull/12435
• docs: Add missing --force flag documentation by @Goldyvaiiii in https://github.com/vercel/turborepo/pull/12440
• fix: Prevent panic in turbo watch with persistent tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12459
• fix: Support turbo watch in single-package workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/12460
• fix: Missing deps after npm lockfile parsing by @anthonyshew in https://github.com/vercel/turborepo/pull/12464
• docs: Add AI agent detection and automatic markdown rewrites by @molebox in https://github.com/vercel/turborepo/pull/12462
• fix: Resolve generator name conflicts across workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/12467
• fix: Remove root package.json from --affected global triggers by @anthonyshew in https://github.com/vercel/turborepo/pull/12469
• fix: Show run summary after TUI exits by @anthonyshew in https://github.com/vercel/turborepo/pull/12471

New Contributors

• @ramanverse made their first contribution in https://github.com/vercel/turborepo/pull/12390
• @lilianakatrina684-a11y made their first contribution in https://github.com/vercel/turborepo/pull/12412
• @floriansalihovic made their first contribution in https://github.com/vercel/turborepo/pull/11952
• @Goldyvaiiii made their first contribution in https://github.com/vercel/turborepo/pull/12436
• @attehuhtakangas made their first contribution in https://github.com/vercel/turborepo/pull/12443

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.20...v2.8.21

<!-- Release notes generated using configuration in .github/release.yml at v2.8.20 -->

What's Changed

Changelog

• fix: Prevent stdin from being dropped for persistent tasks in stream mode by @anthonyshew in https://github.com/vercel/turborepo/pull/12394

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.19...v2.8.20